CVE-2014-8924

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 7.2.2 before IF15 and 7.5 before IF24 Tivoli Asset Discovery for Distributed versions 7.2.2 before IF15 and 7.5 before IF24

Description The issue allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For IBM License Metric Tool versions 7.2.2 before IF15, apply the IF15 fix or later. For IBM License Metric Tool version 7.5 before IF24, apply the IF24 fix or later. For Tivoli Asset Discovery for Distributed versions 7.2.2 before IF15, apply the IF15 fix or later. For Tivoli Asset Discovery for Distributed version 7.5 before IF24, apply the IF24 fix or later.